Show HN: We post-trained a model that pen tests instead of refusing
Not a pilot. A YC startup just shipped an AI pen-test tool that actually breaks into systems—something OpenAI and Anthropic won't let their models do.
Why it matters
A post-trained model fine-tuned on CTF data is enabling mid-market companies to run AI-powered security audits without enterprise gatekeeping. The counterintuitive move: removing guardrails responsibly to democratize vulnerability detection.
The key facts
8 to knowPost-trained on decade of capture-the-flag contests using Kimi K2.6 base model
Two modes: read-only security scan + active adversarial pen-test (gated)
Security scan found integer overflow vulnerability in Bank of Anthos demo
Multi-agent swarm architecture with parallel subagents
Free tier: up to 2M tokens; pay-per-token beyond
Local CLI binary; inference API over TLS; free installation
Company: Cosine (YC W23)
SFT on CTF writeups + RL with verifiable exploit rewards
Go to the source
Hacker Newsargusred.com
Publisher excerpt: Anthropic and OpenAI's publicly available models are explicitly guard-railed so that they refuse offensive tasks. And their cyber-focussed models are gated for enterprises. This leaves SMEs and mid market open to major vulnerabilities. AI can be used as both an adversarial and defensive tool in the…